Managing Sign-In Methods After Setup
Add, test, activate, replace and turn off the ways your team signs in to GraphnAI, at any time after the setup wizard, from the Identity Providers page.
Requires role: Admin
Related: Multi-Provider Platform Authentication & Setup, On-Premises Directory Sign-In (Active Directory / LDAP), User Management & RBAC
Overview
The setup wizard sets up one way for your team to sign in. Later you might move from Entra ID to Okta, add cloud single sign-on to a directory-only deployment, or merge tenants. Make those changes on Admin > Identity Providers, with no downtime and no reset.
This guide covers how people sign in to GraphnAI. The Identity Bridge is separate: it collects directories into the graph for analysis. One Entra ID tenant can do both, and you set up each role on its own.
Two rules always hold:
- You can't remove your last sign-in method. Turning off or deleting a method is refused unless another active method remains.
- Switching methods leaves no gap. Activating a new provider replaces the active one in a single step. A sign-in during the switch always finds exactly one active provider.
The Identity Providers Page
The page lists the directories you collect from and the ways people sign in. Choose an OIDC provider from the menu at the top. Each one shows its type, and badges mark the Active sign-in provider and the First-run provider from the setup wizard.
The buttons next to the menu act on the selected provider: Test sign-in and activate or Use for sign-in, Deactivate, Edit and Delete. Select Add provider to add a method. Your on-premises directory has its own card, On-premises directory sign-in, below the provider details.
Adding a Sign-In Method
Add provider opens Add an identity provider with five choices:
| Choice | How it's added |
|---|---|
| Microsoft Entra ID (automatic) | A Sign in with Microsoft pop-up that creates the app registration for you, as in the setup wizard. Enter details manually instead opens a form for the tenant ID, client ID, and a client secret or certificate. |
| Okta, AWS (Amazon Cognito), Generic OIDC | A short issuer and client form. The provider is added turned off, until a test sign-in proves it works. |
| Active Directory (LDAPS) | The Directory sign-in dialog: hosts, base DN, service account and certificate trust. |
Add Entra ID Automatically
Choosing Microsoft Entra ID (automatic) shows Sign in with Microsoft. Select it, allow pop-ups for the GraphnAI address if your browser asks, and sign in as an administrator of the tenant you're adding. The sign-in needs a valid license and a browser that can reach https://api.graphnai.com. See Usage Reporting. If it can't, use Enter details manually instead. That account doesn't have to be yours, or in the tenant you signed in to GraphnAI with. GraphnAI creates the app registration, service principal and certificate.
Two switches set what the tenant is for. Both are on by default.
- Use for sign-in: people can sign in with this tenant as soon as it's added. If another provider is active, the helper text names it, and the new tenant replaces it with no downtime.
- Also collect this directory: the bridge collects the tenant's identities into your graph. This uses one of your licensed directory sources, and the first collection starts after approval.
Turn off Also collect this directory to add a tenant for sign-in only. It's never collected and uses no licensed directory source, so you can add it even at your directory source limit. That covers a move from Entra ID to Okta, for example: add the sign-in tenant next to the one you already collect.
When the tenant is collected, a Microsoft administrator must approve read-only directory access. The dialog shows One more step: approve directory access:
- Select Open the Microsoft approval page and approve the access.
- Select I've approved it. GraphnAI checks with Microsoft before it marks the tenant ready.
Approval can take up to a minute to show. If Microsoft hasn't reported it yet, the dialog says so. Try again shortly. Skip for now leaves the tenant added but not collected until approval.
For Okta, AWS and generic providers, Also collect this directory is off and locked. The helper text says the provider only signs people in. The directory sign-in dialog doesn't offer it.
NOTE
GraphnAI refuses a duplicate tenant, or one past your licensed directory sources, before it creates anything in your Microsoft tenant. A refused add leaves no app registration behind.
Activating a Method: Test Sign-In, Then Switch
An Okta, AWS or generic provider stays turned off until you prove it works.
- Choose the provider from the menu, then select Test sign-in and activate.
- Sign in on the provider's own page, as any user that provider lets in. You have 10 minutes.
- Back on the Identity Providers page, the Test sign-in succeeded dialog asks whether to make it the active sign-in method.
- Select Activate. If another provider was active, the new one replaces it in the same step, with no downtime. Select Not now to leave it turned off.
If the test sign-in doesn't finish, an amber banner says why:
| Banner | What to do |
|---|---|
| "The test sign-in failed. Run it again." | Check the provider's settings, then run the test again. |
| "The test sign-in took too long and expired. Run it again." | Run the test again and finish it within 10 minutes. |
| "Your identity provider didn't respond during the test sign-in." | Try again. If it keeps failing, check that GraphnAI can reach the provider. |
The test only proves the provider works. It doesn't sign anyone in to GraphnAI or change who has access.
An Entra ID tenant added with Use for sign-in turned off shows Use for sign-in instead. Select it, then confirm. The sign-in already proved the tenant works, so it needs no test. When directory sign-in isn't active, the confirmation also shows the redirect URI. Check that the app registration lists it before you confirm.
Replacing Your Sign-In Provider
To move from one provider to another, for example from Entra ID to Okta:
- Select Add provider, then Okta (or AWS (Amazon Cognito), or Generic OIDC). Fill in the issuer and client details, then select Add provider.
- Choose the new provider from the menu, then select Test sign-in and activate.
- Select Activate. The new provider becomes active and the old one turns off in the same step.
The old provider stays set up, turned off. Delete it once you're satisfied, or keep it to switch back to.
IMPORTANT
User accounts carry over by email. When a person signs in through the new provider, the account you added for the old provider under the same email moves to the new provider's user ID automatically. Its role and session preferences come with it, and its old sessions are signed out. No re-invite is needed. On a provider other than Entra ID, the new provider must report the email as verified.
Group authorizations don't carry over. Group IDs are per provider, so access granted through groups must be added again for the new provider's groups.
An account nobody signs in with keeps its email, which blocks an invite to that address. Delete it on the Users tab if you need the address for an invite.
Deactivating or Removing a Method
Deactivate turns off the active OIDC provider. Delete removes a provider and its settings, after you confirm. When the provider is collected, deleting it also stops collection from that tenant.
Both are refused when they would leave no active sign-in method. The buttons are disabled, with the line "Add or turn on another sign-in method first. At least one must stay active." The server refuses too.
On a deployment with both cloud single sign-on and directory sign-in, you can turn off either one. The other keeps sign-in working. The First-run provider from the setup wizard can't be deleted.
Trusting a Directory (LDAPS) Certificate
When you add or edit directory sign-in and select Test connection, GraphnAI connects to your domain controller. If its certificate isn't trusted yet, GraphnAI reads the controller's certificate chain and shows it, the same way the Identity Bridge does.
Domain controllers usually send only their own certificate, so GraphnAI looks up the certificate authority that issued it. It downloads the authority's certificate from a web address in the controller's certificate when there is one. For Active Directory Certificate Services, it reads the authority through another directory you already saved whose connection it trusts. Only a certificate that signs itself is marked Root.
- In Trust the directory certificate, review each certificate's subject, issuer, validity dates and names. An expired certificate carries an Expired badge.
- Trust the certificate authority:
- The chain reaches a root: Compare the root's SHA-256 fingerprint with your certificate authority's, then select Trust root certificate.
- The chain stops at the controller's certificate: Paste the root certificate of the authority the dialog names and select Check certificate, or select Upload a file. GraphnAI checks that it issued the controller's certificate before it offers to trust it.
GraphnAI fills in the trusted certificate as your directory's certificate authority and runs the test again. Select Save once it passes.
Trust this certificate anyway trusts the controller's own certificate. It works only until the controller renews its certificate, usually once a year, so trust the root when you can.
You can still paste a CA certificate into Certificate authority (PEM, optional) yourself, or turn on Allow unverified certificates (testing only) for a test deployment. If GraphnAI can't read the certificate, it asks you to paste the CA certificate instead.
The certificate you trust here applies only to directory sign-in. The Identity Bridge keeps its own trusted certificates.
What Doesn't Change
- The setup wizard stays closed. Once any sign-in method is active, all of this happens on the Identity Providers page.
- An expired license never blocks sign-in changes. While the license is expired or missing, you can still fix or change your sign-in methods.